/**
 * Measures, against the running stack, exactly what a script executing in the
 * page's own origin can and cannot reach when the session lives in an
 * HttpOnly cookie behind a BFF.
 *
 * Not a simulation. Every number the article prints comes from one run of
 * this file against `next start` in front of the real Go API in front of
 * PostgreSQL. Run:
 *
 *   node bench/bff/measure.mjs > bench/bff/measurements.json
 */
import { chromium } from "@playwright/test";
import { randomUUID } from "node:crypto";

const BASE = process.env.BASE_URL ?? "http://localhost:3417";
const API = process.env.DE_API_URL ?? "http://localhost:8091";
const PASSWORD = "correct horse battery staple";

const out = { base: BASE, api: API, steps: [] };
function record(step) {
  out.steps.push(step);
}

const browser = await chromium.launch({
  executablePath: process.env.PLAYWRIGHT_CHROMIUM_PATH || undefined,
});
const context = await browser.newContext();
const page = await context.newPage();

const name = `bff-${randomUUID().slice(0, 8)}`;
const email = `${name}@example.dev`;

await page.goto(`${BASE}/register`);
await page.getByLabel("Имя пользователя").fill(name);
await page.getByLabel("Email").fill(email);
await page.getByLabel("Пароль").fill(PASSWORD);
await page.getByRole("button", { name: "Создать аккаунт" }).click();
await page.getByTestId("account-name").waitFor();

// Give the account something private to steal, so "the attacker read the
// user's data" is a real read of real rows rather than an empty list.
await page.goto(`${BASE}/python/data-structures/dict`);
await page.getByRole("button", { name: "☆ В закладки" }).click();
await page.getByRole("button", { name: "★ В закладках" }).waitFor();
await page.waitForTimeout(500);

// --- 1. What the browser actually stores -----------------------------------
const cookies = await context.cookies();
record({
  id: "cookie-jar",
  what: "Куки, которые браузер получил от BFF",
  value: cookies
    .filter((c) => c.name.startsWith("de_"))
    .map((c) => ({
      name: c.name,
      httpOnly: c.httpOnly,
      sameSite: c.sameSite,
      secure: c.secure,
      valueLength: c.value.length,
    })),
});

// --- 2. What a script in the page can read ---------------------------------
const scriptView = await page.evaluate(() => ({
  documentCookie: document.cookie,
  localStorageKeys: Object.keys(localStorage),
  sessionStorageKeys: Object.keys(sessionStorage),
}));
record({
  id: "script-view",
  what: "Что видит скрипт, выполняющийся на странице",
  value: scriptView,
});

// --- 3. What that same script CAN still do (session riding) ----------------
// This is the attack the BFF does not stop: the code runs in the page's own
// origin, so the browser attaches the cookie for it.
const ridden = await page.evaluate(async () => {
  const res = await fetch("/api/bookmarks", { credentials: "same-origin" });
  const body = await res.json();
  return { status: res.status, body };
});
record({
  id: "session-riding",
  what: "Тот же скрипт читает личные данные через BFF",
  value: ridden,
});

// --- 4. The same script talking to the upstream API directly ---------------
const directUpstream = await page.evaluate(async (apiUrl) => {
  try {
    const res = await fetch(`${apiUrl}/api/v1/bookmarks`, { credentials: "include" });
    return { status: res.status, body: await res.text() };
  } catch (err) {
    return { status: null, error: String(err) };
  }
}, API);
record({
  id: "direct-upstream",
  what: "Тот же скрипт обращается к Go-сервису напрямую",
  value: directUpstream,
});

// --- 5. A state-changing call without the CSRF header ----------------------
const noCsrf = await page.evaluate(async () => {
  const res = await fetch("/api/bookmarks", {
    method: "POST",
    credentials: "same-origin",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({ article_slug: "dict-internals" }),
  });
  return { status: res.status, body: await res.json().catch(() => null) };
});
record({ id: "no-csrf", what: "Изменяющий запрос без CSRF-заголовка", value: noCsrf });

// --- 6. Response shapes: BFF vs upstream ----------------------------------
const bffMe = await page.evaluate(async () => {
  const res = await fetch("/api/auth/me", { credentials: "same-origin" });
  const text = await res.text();
  return { status: res.status, bytes: new TextEncoder().encode(text).length, text };
});
record({ id: "bff-me", what: "Ответ BFF на /api/auth/me", value: bffMe });

await browser.close();

out.recordedAt = new Date().toISOString();
process.stdout.write(JSON.stringify(out, null, 2));